Ticket #17975: patch_2017_01_20.txt

File patch_2017_01_20.txt, 16.2 KB (added by michaelsonntag, 10 months ago)

Patch suggestion (v4)

Line 
1diff --git a/changes/change_separate_exit_and_relay.txt b/changes/change_separate_exit_and_relay.txt
2new file mode 100644
3index 0000000..28db1d2
4--- /dev/null
5+++ b/changes/change_separate_exit_and_relay.txt
6@@ -0,0 +1,2 @@
7+- Minor features:
8+    - Allow separation of exit and relay traffic to different source IP addresses (Ticket #17975). Written by Michael Sonntag.
9diff --git a/doc/tor.1.txt b/doc/tor.1.txt
10index 46b1077..196ce2d 100644
11--- a/doc/tor.1.txt
12+++ b/doc/tor.1.txt
13@@ -640,6 +640,20 @@ GENERAL OPTIONS
14     This setting will be ignored for connections to the loopback addresses
15     (127.0.0.0/8 and ::1).
16 
17+[[OutboundBindAddressOR]] **OutboundBindAddressOR** __IP__::
18+    Make all outbound non-exit (=relay and other) connections originate from the IP
19+    address specified. This option overrides **OutboundBindAddress** for the same
20+    IP version. This option may be used twice, once with an IPv4 address and once
21+    with an IPv6 address. This setting will be ignored for connections to the
22+    loopback addresses (127.0.0.0/8 and ::1).
23+
24+[[OutboundBindAddressExit]] **OutboundBindAddressExit** __IP__::
25+    Make all outbound exit connections originate from the IP address specified. This
26+    option overrides **OutboundBindAddress** for the same IP version. This option
27+    may be used twice, once with an IPv4 address and once with an IPv6 address. This
28+    setting will be ignored for connections to the loopback addresses (127.0.0.0/8
29+    and ::1).
30+
31 [[PidFile]] **PidFile** __FILE__::
32     On startup, write our PID to FILE. On clean shutdown, remove
33     FILE. Can not be changed while tor is running.
34diff --git a/src/config/torrc.sample.in b/src/config/torrc.sample.in
35index 5328206..3777744 100644
36--- a/src/config/torrc.sample.in
37+++ b/src/config/torrc.sample.in
38@@ -95,7 +95,12 @@
39 
40 ## If you have multiple network interfaces, you can specify one for
41 ## outgoing traffic to use.
42-# OutboundBindAddress 10.0.0.5
43+## OutboundBindAddressExit will be used for all exit traffic, while
44+## OutboundBindAddressOR will be used for all other connections.
45+## If you do not wish to differentiate, use OutboundBindAddress to
46+## specify the same address for both in a single line.
47+#OutboundBindAddressExit 10.0.0.4
48+#OutboundBindAddressOR 10.0.0.5
49 
50 ## A handle for your relay, so people don't have to refer to it by key.
51 ## Nicknames must be between 1 and 19 characters inclusive, and must
52diff --git a/src/or/config.c b/src/or/config.c
53index f885cbc..67c718b 100644
54--- a/src/or/config.c
55+++ b/src/or/config.c
56@@ -405,6 +405,8 @@ static config_var_t option_vars_[] = {
57   V(ORListenAddress,             LINELIST, NULL),
58   VPORT(ORPort,                      LINELIST, NULL),
59   V(OutboundBindAddress,         LINELIST,   NULL),
60+  V(OutboundBindAddressOR,       LINELIST,   NULL),
61+  V(OutboundBindAddressExit,     LINELIST,   NULL),
62 
63   OBSOLETE("PathBiasDisableRate"),
64   V(PathBiasCircThreshold,       INT,      "-1"),
65@@ -7928,60 +7930,84 @@ getinfo_helper_config(control_connection_t *conn,
66   return 0;
67 }
68 
69-/** Parse outbound bind address option lines. If <b>validate_only</b>
70- * is not 0 update OutboundBindAddressIPv4_ and
71- * OutboundBindAddressIPv6_ in <b>options</b>. On failure, set
72- * <b>msg</b> (if provided) to a newly allocated string containing a
73- * description of the problem and return -1. */
74+/* Check whether an address has already been set against the options
75+ * depending on address family and destination type. Any exsting
76+ * value will lead to a fail, even if it is the same value. If not
77+ * set and not only validating, copy it into this location too.
78+ * Returns 0 on success or -1 if this address is already set.
79+ */
80 static int
81-parse_outbound_addresses(or_options_t *options, int validate_only, char **msg)
82+verify_and_store_outbound_address(sa_family_t family, tor_addr_t *addr,
83+       outbound_addr_t type, or_options_t *options, int validate_only)
84 {
85-  const config_line_t *lines = options->OutboundBindAddress;
86-  int found_v4 = 0, found_v6 = 0;
87-
88+  if (type<0 || type>=OUTBOUND_ADDR_MAX
89+      || (family!=AF_INET && family!=AF_INET6)) {
90+    return -1;
91+  }
92+  int fam_index=0;
93+  if (family==AF_INET6) {
94+    fam_index=1;
95+  }
96+  tor_addr_t *dest=&options->OutboundBindAddresses[type][fam_index];
97+  if (!tor_addr_is_null(dest)) {
98+    return -1;
99+  }
100   if (!validate_only) {
101-    memset(&options->OutboundBindAddressIPv4_, 0,
102-           sizeof(options->OutboundBindAddressIPv4_));
103-    memset(&options->OutboundBindAddressIPv6_, 0,
104-           sizeof(options->OutboundBindAddressIPv6_));
105+    tor_addr_copy(dest, addr);
106   }
107+  return 0;
108+}
109+
110+/* Parse a list of address lines for a specific destination type.
111+ * Will store them into the options if not validate_only. If a
112+ * problem occurs, a suitable error message is store in msg.
113+ * Returns 0 on success or -1 if any address is already set.
114+ */
115+static int
116+parse_outbound_address_lines(const config_line_t *lines, outbound_addr_t type,
117+           or_options_t *options, int validate_only, char **msg)
118+{
119+  tor_addr_t addr;
120+  sa_family_t family;
121   while (lines) {
122-    tor_addr_t addr, *dst_addr = NULL;
123-    int af = tor_addr_parse(&addr, lines->value);
124-    switch (af) {
125-    case AF_INET:
126-      if (found_v4) {
127-        if (msg)
128-          tor_asprintf(msg, "Multiple IPv4 outbound bind addresses "
129-                       "configured: %s", lines->value);
130-        return -1;
131-      }
132-      found_v4 = 1;
133-      dst_addr = &options->OutboundBindAddressIPv4_;
134-      break;
135-    case AF_INET6:
136-      if (found_v6) {
137-        if (msg)
138-          tor_asprintf(msg, "Multiple IPv6 outbound bind addresses "
139-                       "configured: %s", lines->value);
140-        return -1;
141-      }
142-      found_v6 = 1;
143-      dst_addr = &options->OutboundBindAddressIPv6_;
144-      break;
145-    default:
146+    family = tor_addr_parse(&addr, lines->value);
147+    if (verify_and_store_outbound_address(family, &addr, type,
148+                                 options, validate_only)) {
149       if (msg)
150-        tor_asprintf(msg, "Outbound bind address '%s' didn't parse.",
151-                     lines->value);
152+        tor_asprintf(msg, "Multiple%s%s outbound bind addresses "
153+                     "configured: %s",
154+                     family==AF_INET?" IPv4":(family==AF_INET6?" IPv6":""),
155+                     type==OUTBOUND_ADDR_OR?" OR":
156+                     (type==OUTBOUND_ADDR_EXIT?" exit":""), lines->value);
157       return -1;
158     }
159-    if (!validate_only)
160-      tor_addr_copy(dst_addr, &addr);
161     lines = lines->next;
162   }
163   return 0;
164 }
165 
166+/** Parse outbound bind address option lines. If <b>validate_only</b>
167+ * is not 0 update OutboundBindAddresses in <b>options</b>.
168+ * Only one address can be set for any of these values.
169+ * On failure, set <b>msg</b> (if provided) to a newly allocated string
170+ * containing a description of the problem and return -1.
171+ */
172+static int
173+parse_outbound_addresses(or_options_t *options, int validate_only, char **msg)
174+{
175+  if (!validate_only) {
176+    memset(&options->OutboundBindAddresses, 0,
177+           sizeof(options->OutboundBindAddresses));
178+  }
179+  parse_outbound_address_lines(options->OutboundBindAddress,
180+                      OUTBOUND_ADDR_EXIT_AND_OR, options, validate_only, msg);
181+  parse_outbound_address_lines(options->OutboundBindAddressOR,
182+                      OUTBOUND_ADDR_OR, options, validate_only, msg);
183+  parse_outbound_address_lines(options->OutboundBindAddressExit,
184+                      OUTBOUND_ADDR_EXIT, options, validate_only, msg);
185+  return 0;
186+}
187+
188 /** Load one of the geoip files, <a>family</a> determining which
189  * one. <a>default_fname</a> is used if on Windows and
190  * <a>fname</a> equals "<default>". */
191diff --git a/src/or/connection.c b/src/or/connection.c
192index 7e0ee45..4421534 100644
193--- a/src/or/connection.c
194+++ b/src/or/connection.c
195@@ -134,6 +134,8 @@ static int connection_read_https_proxy_response(connection_t *conn);
196 static void connection_send_socks5_connect(connection_t *conn);
197 static const char *proxy_type_to_string(int proxy_type);
198 static int get_proxy_type(void);
199+const tor_addr_t *conn_get_outbound_address(sa_family_t family,
200+                  const or_options_t *options, unsigned int conn_type);
201 
202 /** The last addresses that our network interface seemed to have been
203  * binding to.  We use this as one way to detect when our IP changes.
204@@ -1771,7 +1773,7 @@ connection_connect_sockaddr,(connection_t *conn,
205 
206   /*
207    * We've got the socket open; give the OOS handler a chance to check
208-   * against configuured maximum socket number, but tell it no exhaustion
209+   * against configured maximum socket number, but tell it no exhaustion
210    * failure.
211    */
212   connection_check_oos(get_n_open_sockets(), 0);
213@@ -1890,6 +1892,47 @@ connection_connect_log_client_use_ip_version(const connection_t *conn)
214   }
215 }
216 
217+/** Retrieve the outbound address depending on the protocol (IPv4 or IPv6)
218+ * and the connection type (relay, exit, ...)
219+ * Return a socket address or NULL in case nothing is configured.
220+ **/
221+const tor_addr_t *
222+conn_get_outbound_address(sa_family_t family,
223+             const or_options_t *options, unsigned int conn_type)
224+{
225+  const tor_addr_t *ext_addr = NULL;
226+
227+  int fam_index=0;
228+  if (family==AF_INET6) {
229+    fam_index=1;
230+  }
231+  // If an exit connection, use the exit address (if present)
232+  if (conn_type == CONN_TYPE_EXIT) {
233+    if (!tor_addr_is_null(
234+        &options->OutboundBindAddresses[OUTBOUND_ADDR_EXIT][fam_index])) {
235+      ext_addr = &options->OutboundBindAddresses[OUTBOUND_ADDR_EXIT]
236+                 [fam_index];
237+    } else if (!tor_addr_is_null(
238+                 &options->OutboundBindAddresses[OUTBOUND_ADDR_EXIT_AND_OR]
239+                 [fam_index])) {
240+      ext_addr = &options->OutboundBindAddresses[OUTBOUND_ADDR_EXIT_AND_OR]
241+                 [fam_index];
242+    }
243+  } else { // All non-exit connections
244+    if (!tor_addr_is_null(
245+           &options->OutboundBindAddresses[OUTBOUND_ADDR_OR][fam_index])) {
246+      ext_addr = &options->OutboundBindAddresses[OUTBOUND_ADDR_OR]
247+                 [fam_index];
248+    } else if (!tor_addr_is_null(
249+                 &options->OutboundBindAddresses[OUTBOUND_ADDR_EXIT_AND_OR]
250+                 [fam_index])) {
251+      ext_addr = &options->OutboundBindAddresses[OUTBOUND_ADDR_EXIT_AND_OR]
252+                 [fam_index];
253+    }
254+  }
255+  return ext_addr;
256+}
257+
258 /** Take conn, make a nonblocking socket; try to connect to
259  * addr:port (port arrives in *host order*). If fail, return -1 and if
260  * applicable put your best guess about errno into *<b>socket_error</b>.
261@@ -1911,26 +1954,15 @@ connection_connect(connection_t *conn, const char *address,
262   struct sockaddr *bind_addr = NULL;
263   struct sockaddr *dest_addr;
264   int dest_addr_len, bind_addr_len = 0;
265-  const or_options_t *options = get_options();
266-  int protocol_family;
267 
268   /* Log if we didn't stick to ClientUseIPv4/6 or ClientPreferIPv6OR/DirPort
269    */
270   connection_connect_log_client_use_ip_version(conn);
271 
272-  if (tor_addr_family(addr) == AF_INET6)
273-    protocol_family = PF_INET6;
274-  else
275-    protocol_family = PF_INET;
276-
277   if (!tor_addr_is_loopback(addr)) {
278     const tor_addr_t *ext_addr = NULL;
279-    if (protocol_family == AF_INET &&
280-        !tor_addr_is_null(&options->OutboundBindAddressIPv4_))
281-      ext_addr = &options->OutboundBindAddressIPv4_;
282-    else if (protocol_family == AF_INET6 &&
283-             !tor_addr_is_null(&options->OutboundBindAddressIPv6_))
284-      ext_addr = &options->OutboundBindAddressIPv6_;
285+    ext_addr = conn_get_outbound_address(tor_addr_family(addr), get_options(),
286+                                         conn->type);
287     if (ext_addr) {
288       memset(&bind_addr_ss, 0, sizeof(bind_addr_ss));
289       bind_addr_len = tor_addr_to_sockaddr(ext_addr, 0,
290diff --git a/src/or/or.h b/src/or/or.h
291index 6292c49..3578167 100644
292--- a/src/or/or.h
293+++ b/src/or/or.h
294@@ -3545,6 +3545,12 @@ typedef struct routerset_t routerset_t;
295  * to pick its own port. */
296 #define CFG_AUTO_PORT 0xc4005e
297 
298+/** Enumeration of outbound address configuration types:
299+ * Exit-only, OR-only, or both */
300+typedef enum {OUTBOUND_ADDR_EXIT, OUTBOUND_ADDR_OR,
301+              OUTBOUND_ADDR_EXIT_AND_OR,
302+              OUTBOUND_ADDR_MAX} outbound_addr_t;
303+
304 /** Configuration options for a Tor process. */
305 typedef struct {
306   uint32_t magic_;
307@@ -3628,10 +3634,14 @@ typedef struct {
308   config_line_t *ControlListenAddress;
309   /** Local address to bind outbound sockets */
310   config_line_t *OutboundBindAddress;
311-  /** IPv4 address derived from OutboundBindAddress. */
312-  tor_addr_t OutboundBindAddressIPv4_;
313-  /** IPv6 address derived from OutboundBindAddress. */
314-  tor_addr_t OutboundBindAddressIPv6_;
315+  /** Local address to bind outbound relay sockets */
316+  config_line_t *OutboundBindAddressOR;
317+  /** Local address to bind outbound exit sockets */
318+  config_line_t *OutboundBindAddressExit;
319+  /** Addresses derived from the various OutboundBindAddress lines.
320+   * [][0] is IPv4, [][1] is IPv6
321+   */
322+  tor_addr_t OutboundBindAddresses[OUTBOUND_ADDR_MAX][2];
323   /** Directory server only: which versions of
324    * Tor should we tell users to run? */
325   config_line_t *RecommendedVersions;
326diff --git a/src/or/policies.c b/src/or/policies.c
327index 84600f7..aea1b11 100644
328--- a/src/or/policies.c
329+++ b/src/or/policies.c
330@@ -2019,10 +2019,10 @@ policies_copy_ipv4h_to_smartlist(smartlist_t *addr_list, uint32_t ipv4h_addr)
331   }
332 }
333 
334-/** Helper function that adds copies of
335- * or_options->OutboundBindAddressIPv[4|6]_ to a smartlist as tor_addr_t *, as
336- * long as or_options is non-NULL, and the addresses are not
337- * tor_addr_is_null(), by passing them to policies_add_addr_to_smartlist.
338+/** Helper function that adds copies of or_options->OutboundBindAddresses
339+ * to a smartlist as tor_addr_t *, as long as or_options is non-NULL, and
340+ * the addresses are not tor_addr_is_null(), by passing them to
341+ * policies_add_addr_to_smartlist.
342  *
343  * The caller is responsible for freeing all the tor_addr_t* in the smartlist.
344  */
345@@ -2031,10 +2031,14 @@ policies_copy_outbound_addresses_to_smartlist(smartlist_t *addr_list,
346                                               const or_options_t *or_options)
347 {
348   if (or_options) {
349-    policies_copy_addr_to_smartlist(addr_list,
350-                                    &or_options->OutboundBindAddressIPv4_);
351-    policies_copy_addr_to_smartlist(addr_list,
352-                                    &or_options->OutboundBindAddressIPv6_);
353+    for (int i=0;i<OUTBOUND_ADDR_MAX;i++) {
354+      for (int j=0;j<2;j++) {
355+        if (!tor_addr_is_null(&or_options->OutboundBindAddresses[i][j])) {
356+          policies_copy_addr_to_smartlist(addr_list,
357+                          &or_options->OutboundBindAddresses[i][j]);
358+        }
359+      }
360+    }
361   }
362 }
363 
364@@ -2051,10 +2055,10 @@ policies_copy_outbound_addresses_to_smartlist(smartlist_t *addr_list,
365  *  - if ipv6_local_address is non-NULL, and not the null tor_addr_t, add it
366  *    to the list of configured addresses.
367  * If <b>or_options->ExitPolicyRejectLocalInterfaces</b> is true:
368- *  - if or_options->OutboundBindAddressIPv4_ is not the null tor_addr_t, add
369- *    it to the list of configured addresses.
370- *  - if or_options->OutboundBindAddressIPv6_ is not the null tor_addr_t, add
371- *    it to the list of configured addresses.
372+ *  - if or_options->OutboundBindAddresses[][0] (=IPv4) is not the null
373+ *    tor_addr_t, add it to the list of configured addresses.
374+ *  - if or_options->OutboundBindAddresses[][1] (=IPv6) is not the null
375+ *    tor_addr_t, add it to the list of configured addresses.
376  *
377  * If <b>or_options->BridgeRelay</b> is false, append entries of default
378  * Tor exit policy into <b>result</b> smartlist.
379diff --git a/src/test/test_policy.c b/src/test/test_policy.c
380index 4df40f6..71a3111 100644
381--- a/src/test/test_policy.c
382+++ b/src/test/test_policy.c
383@@ -1083,8 +1083,12 @@ test_policies_getinfo_helper_policies(void *arg)
384   append_exit_policy_string(&mock_my_routerinfo.exit_policy, "reject *6:*");
385 
386   mock_options.IPv6Exit = 1;
387-  tor_addr_from_ipv4h(&mock_options.OutboundBindAddressIPv4_, TEST_IPV4_ADDR);
388-  tor_addr_parse(&mock_options.OutboundBindAddressIPv6_, TEST_IPV6_ADDR);
389+  tor_addr_from_ipv4h(
390+      &mock_options.OutboundBindAddresses[OUTBOUND_ADDR_EXIT][0],
391+      TEST_IPV4_ADDR);
392+  tor_addr_parse(
393+      &mock_options.OutboundBindAddresses[OUTBOUND_ADDR_EXIT][1],
394+      TEST_IPV6_ADDR);
395 
396   mock_options.ExitPolicyRejectPrivate = 1;
397   mock_options.ExitPolicyRejectLocalInterfaces = 1;